Windows 10 Logging

[bostonman]

I have a question, I know Windows 10 (and probably all versions of Windows) logs things like login, shutdown, etc...

Assuming no additional software is installed, and the computer isn't on a network, does it track other stuff from a user such as which programs were being used, how much activity was being performed, etc...?

[Jeroen3]

Yes, there is performance and diagnosis analysis.

[bostonman]

So I could go back a week and see how active a computer was at some point?

I'm trying to see if someone used a computer while I wasn't home over the course of days. I don't see any new files, but trying to see if someone edited say an open spreadsheet, or which programs were loaded.

Obviously any new saved files would show, but if i had an Excel sheet open and someone made changes without me knowing, I returned, continued editing the sheet, saved it, would I be able to see activity during a specific time frame? Or would the log show how active a person was such as how often keystrokes were pressed or whatever?

[Jeroen3]

Well, you'd have the "recent files" list...

Those other logs are stored somewhere, but I was unable to find docs for those features. Many are also used for "improvements" by Microsoft and not public anyway.

[bostonman]

I'm also asking for curiosity.

Windows login would obviously be added to the log, but what if the computer locks the screen and then is unlocked with a password, would that be in the log too or does it not concern itself with locked screen.

My other question: if someone wasn't very active on the computer, but doing just enough to keep it from locking, would that show in the Windows log as inactivity or would it not care?

[SilverSolder]

[...]
 if i had an Excel sheet open and someone made changes without me knowing, I returned, continued editing the sheet, saved it, would I be able to see activity during a specific time frame? Or would the log show how active a person was such as how often keystrokes were pressed or whatever?

That scenario would be very difficult to catch, because the file would not get a new time stamp if they did not save it.  Can you compare it with an earlier backup of the file?

Where I work, walking away from your computer without locking the screen is sufficient reason to get fired...  some customers are very sensitive about their data!

[bostonman]

I guess I'm trying to understand a few things; some for a problem in hand and the other for general understanding.

The first is whether automatic computer locking (and unlocking) is logged. From research, I believe this is true as each time the computer locks (whether manually or automatic) and then unlocked, it's logged. So someone can't just turn on a computer and let it sit idle for an hour, unlock the screen, and then let it sit idle again. Is this true?

The second is: does Windows log whether a computer sat idle or was actually being used for productivity. In this case, someone could be moving the mouse periodically causing it to not lock. So does Windows keep track of what is being done on a computer (ignoring file date/time stamp)?

 

[Jeroen3]

All credential manager access is logged. And the log "Microsoft Office Alerts" logs all popups (eg: do you want to save foo.docx)

[bostonman]

I'm uncertain what you're asking.

I'm not looking to save anything, just curious what Windows 10 saves in the log during normal usage.

[gbaddeley]

Look at Event Viewer, eventvwr.exe